@frase/mcp-server@0.9.2
Frase MCP Server — The complete content platform for AI agents. Research, write, optimize, and host SEO & GEO-optimized content with built-in AI search visibility monitoring. Includes Frase CMS for auto-optimized web hosting, 122 tools, 9 agent skills, an
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package sends disclosed, account-associated tool-call telemetry to Frase after each tool request, including argument hashes and sizes. I found no opt-out, so this merits a telemetry warning rather than a malicious verdict.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes an MCP tool through the stdio server.
Impact
Frase can associate tool usage and argument hashes with the user's account; raw argument values are not sent by this audit event.
Mechanism
After each tool call, the server sends a fire-and-forget POST with the Frase API key and event metadata, including a hash and size of the arguments.
AI rationale
The package sends disclosed, account-associated tool-call telemetry to Frase after each tool request, including argument hashes and sizes. I found no opt-out, so this merits a telemetry warning rather than a malicious verdict.
Evidence
dist/index.jsdist/lib/mcp-audit.jsREADME.md.lpm-dependency-evidence-043e2986-39d3-4746-ae38-88abb2150cc5/0/npm-linux/dist/config.js
Network endpoints1
next.frase.io/api/v1/audit/mcp-tool (default; derived from the configured Frase API URL)
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Every stdio tool call is wrapped in audit instrumentation.
- The instrumentation POSTs to the configured Frase API using the Frase API key.
- Each event includes the tool name, argument hash and byte size, result status, duration, and error type; the README also describes account identifiers.
- No telemetry opt-out was found in the inspected runtime code or package documentation.
Evidence against
- The README discloses the tool-call telemetry and says argument values, prompts, and conversation content are not collected in readable form.
- Telemetry is sent to the configured Frase API; the default API URL is next.frase.io.
- The setup command’s process execution occurs only when a user explicitly invokes the init subcommand.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/cli/init.jsView file
11import { stdin, stdout } from "node:process";
L12: import { execSync } from "node:child_process";
L13: import { detectTools } from "./detect-tool.js";
High
4*
L5: * Usage: npx @frase/mcp-server init
L6: *
...
L11: import { stdin, stdout } from "node:process";
L12: import { execSync } from "node:child_process";
L13: import { detectTools } from "./detect-tool.js";
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/cli/init.jsView on unpkg · L4dist/mcpb-bundle.jsView file
2960sourceCode = this.opts.code.process(sourceCode, sch);
L2961: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L2962: const validate = makeValidate(this, this.scope.get());
Findings
1 Critical3 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/lib/clean-render.js
HighChild Processdist/cli/init.js
HighShell
HighRuntime Package Installdist/cli/init.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcpb-bundle.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @frase/mcp-server@0.9.2.
See all versions of @frase/mcp-server for other recorded verdicts.
- Review the evidence and your use of @frase/mcp-server@0.9.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.